Date: Thu, 25 Feb 1999 01:14:04 -0500 (EST) From: spork <spork@super-g.com> To: Chris Shenton <cshenton@uucom.com> Cc: GVB <gvbmail@tns.net>, freebsd-net@FreeBSD.ORG Subject: Re: RADIUS Solutions [synchronizing passwords across systems] Message-ID: <Pine.BSF.4.00.9902250111080.5077-100000@super-g.inch.com> In-Reply-To: <86lnhnu83x.fsf@samizdat.uucom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Merit Radius does allow for crypted passwords in the 'users' file, so it is pretty easy to grab the wanted UIDS (generally based on group), mush them through a script and end up with a usable users file. This way you're not needing to make actual accounts on all of your machines other than for staffers. This has been working really well for us so far on our backup auth server. Charles --- Charles Sprickman spork@super-g.com On 24 Feb 1999, Chris Shenton wrote: > GVB <gvbmail@tns.net> writes: > > > I will be running two FreeBSD machines for Radius Authentication. > > Both using Meritt AAA and /etc/passwd for authentication. What is > > the best way to synchronize passwd files between the two systems > > immediatly (or 5 minute incriments) upon user adds and password > > changes, etc. NIS? rsync? etc.. > > I have a somewhat similar situation: FreeBSD passwords on the > account-creation system need to be synchronized between the www/ftp > box, smtp/pop/imap box, and radius servers. > > I wrote a script which uses "scp" to copy the master.password and > group file into a temporary (secure) place on the target, then invokes > makepwdb to convert that into the FreeBSD DB format. > I run it from cron only once an hour at this point. > > I wanted to run the password-pushing script when the user changed > their password, but my changing mechanism is a web form calling a CGI > which talks to poppassd. This means that the "user" which would be > running the pusher is "www" -- so anyone who could reach my web server > could invoke the script, not something I'm happy with, lots of room > for abuse. That's why I just run it periodically out of root's cron. > > I'm not entirely happy with this solution, but I wasn't too happy > turning on NIS -- after avoiding it for five years. The FreeBSD NIS > docs make it sounds like they've taken great care for NIS-sharing > password-oriented files, but still... been burned by NIS security > problems too many times in the past. > > I'd welcome other suggestions... > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.00.9902250111080.5077-100000>